feat(webapp): gate SSO on the hasSso entitlement instead of the Enterprise plan

The SSO settings surface compared the org's plan code against the literal
string "enterprise", so granting SSO meant moving the org onto the
enterprise plan and everything else that implies.

Read the hasSso plan entitlement instead, which billing resolves as
per-org override ?? plan default. Enterprise keeps SSO by default and any
org can now be granted it without a plan change.

Directory Sync effects are gated too, so revoking the entitlement stops
SCIM provisioning rather than only freezing the settings page. An
unreadable entitlement throws so the worker retries — effects are
idempotent, and skipping would silently drop a directory change.

Entitlement reads go through a new SWR cache namespace, replacing an
uncached billing round-trip on every settings load.

Requires @trigger.dev/platform 1.3.0: the older Limits schema strips the
unknown hasSso key during parsing, so the field is invisible until the
dependency is bumped.

Author: matt-aitken

.server-changes/sso-entitlement.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+SSO and Directory Sync can now be enabled for any organization, rather than only those on an Enterprise plan.

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.sso/route.tsx

@@ -39,7 +39,7 @@ import { prisma } from "~/db.server";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { rbac } from "~/services/rbac.server";
 import { ssoController } from "~/services/sso.server";
-import { getCurrentPlan } from "~/services/platform.v3.server";
+import { getSsoEntitlement } from "~/services/platform.v3.server";
 import type { DirectorySyncEffect, DirectorySyncStatus, Role } from "@trigger.dev/plugins";
 import { applyDirectorySyncEffects } from "~/services/directorySyncEffects.server";
 import { flag } from "~/v3/featureFlags.server";
@@ -64,15 +64,15 @@ async function resolveOrg(slug: string) {
 
 function planAllowsSso(plan: unknown): boolean {
   if (!plan || typeof plan !== "object") return false;
-  const subscription = (plan as { v3Subscription?: { plan?: { code?: string } } }).v3Subscription;
-  return subscription?.plan?.code === "enterprise";
+  const subscription = (plan as { v3Subscription?: { plan?: { limits?: { hasSso?: boolean } } } })
+    .v3Subscription;
+  return subscription?.plan?.limits?.hasSso === true;
 }
 
 // Client-side upsell is cosmetic; gate real IdP mutations server-side.
 async function requireSsoEntitlement(orgId: string): Promise<void> {
-  const plan = await getCurrentPlan(orgId);
-  if (!planAllowsSso(plan)) {
-    throw new Response("SSO requires an Enterprise plan", { status: 403 });
+  if ((await getSsoEntitlement(orgId)) !== "entitled") {
+    throw new Response("This organization is not entitled to SSO", { status: 403 });
   }
 }
 
@@ -142,10 +142,7 @@ export const loader = dashboardLoader(
       throw new Response("Not Found", { status: 404 });
     }
 
-    // Not Enterprise: render the upsell for every role, skip role check +
-    // queries, return empty data.
-    const plan = await getCurrentPlan(orgId);
-    if (!planAllowsSso(plan)) {
+    if ((await getSsoEntitlement(orgId)) !== "entitled") {
       return typedjson({
         status: EMPTY_SSO_STATUS,
         orgTitle: context.orgTitle,

apps/webapp/app/services/directorySyncEffects.server.ts

@@ -8,6 +8,7 @@ import {
   removeOrgMemberForDirectory,
 } from "~/models/orgMember.server";
 import { createPlatformNotification } from "~/services/platformNotifications.server";
+import { getSsoEntitlement, type SsoEntitlement } from "~/services/platform.v3.server";
 
 const LAST_OWNER_NOTIFICATION_TITLE = "Directory Sync: last Owner protected";
 
@@ -145,8 +146,37 @@ async function applyEffect(effect: DirectorySyncEffect): Promise<void> {
   }
 }
 
+/**
+ * Applies membership effects, skipping any org that isn't entitled to SSO.
+ *
+ * An unreadable entitlement throws rather than skipping: effects are
+ * idempotent and the worker retries, so retrying is lossless where dropping
+ * would silently lose a directory change.
+ */
 export async function applyDirectorySyncEffects(effects: DirectorySyncEffect[]): Promise<void> {
+  const entitlements = new Map<string, SsoEntitlement>();
+
   for (const effect of effects) {
+    let entitlement = entitlements.get(effect.organizationId);
+    if (entitlement === undefined) {
+      entitlement = await getSsoEntitlement(effect.organizationId);
+      entitlements.set(effect.organizationId, entitlement);
+    }
+
+    if (entitlement === "unknown") {
+      throw retryableEffectError(
+        `directory sync: could not read the SSO entitlement for organization ${effect.organizationId}`
+      );
+    }
+
+    if (entitlement === "not_entitled") {
+      logger.warn("Directory Sync: skipping effect for org without the SSO entitlement", {
+        organizationId: effect.organizationId,
+        kind: effect.kind,
+      });
+      continue;
+    }
+
     await applyEffect(effect);
   }
 }

apps/webapp/app/services/platform.v3.server.ts

@@ -196,6 +196,11 @@ function initializePlatformCache() {
       fresh: 60_000,
       stale: 120_000,
     }),
+    ssoEntitlement: new Namespace<boolean>(ctx, {
+      stores: [memory, redisCacheStore],
+      fresh: 60_000,
+      stale: 120_000,
+    }),
   });
 
   return cache;
@@ -206,6 +211,7 @@ const platformCache = singleton("platformCache", initializePlatformCache);
 function invalidateBillingLimitCaches(organizationId: string) {
   platformCache.billingLimit.remove(organizationId).catch(() => {});
   platformCache.entitlement.remove(organizationId).catch(() => {});
+  platformCache.ssoEntitlement.remove(organizationId).catch(() => {});
 }
 
 export function bustBillingLimitCaches(organizationId: string) {
@@ -757,6 +763,45 @@ export async function getEntitlement(
   return result.val;
 }
 
+export type SsoEntitlement = "entitled" | "not_entitled" | "unknown";
+
+/**
+ * Whether an org may configure and use SSO / Directory Sync.
+ *
+ * `unknown` means billing was configured but unreadable — callers decide:
+ * read paths show the upsell, mutations refuse, and the directory-sync
+ * worker throws so the effect is retried rather than silently dropped.
+ *
+ * Self-hosted deployments have no billing service, so the plugin's presence
+ * (plus the kill switch) is the only gate and this returns `entitled`.
+ *
+ * Loader errors are swallowed inside the loader for the same reason as
+ * `getEntitlement`: @unkey/cache passes the loader promise to waitUntil()
+ * with no .catch(), and returning undefined stops a transient billing
+ * failure from being cached as an access decision.
+ */
+export async function getSsoEntitlement(organizationId: string): Promise<SsoEntitlement> {
+  if (!client) return "entitled";
+
+  const result = await platformCache.ssoEntitlement.swr(organizationId, async () => {
+    try {
+      const response = await client.currentPlan(organizationId);
+      if (!response.success) {
+        recordPlatformFailure("getSsoEntitlement", "no_success");
+        return undefined;
+      }
+      return response.v3Subscription?.plan?.limits?.hasSso === true;
+    } catch (_e) {
+      recordPlatformFailure("getSsoEntitlement", "caught");
+      return undefined;
+    }
+  });
+
+  if (result.err || result.val === undefined) return "unknown";
+
+  return result.val ? "entitled" : "not_entitled";
+}
+
 export type PromoCreditsData = {
   grantedCents: number;
   remainingCents: number;

apps/webapp/package.json

@@ -117,7 +117,7 @@
     "@trigger.dev/core": "workspace:*",
     "@trigger.dev/database": "workspace:*",
     "@trigger.dev/otlp-importer": "workspace:*",
-    "@trigger.dev/platform": "1.2.0",
+    "@trigger.dev/platform": "1.3.0",
     "@trigger.dev/plugins": "workspace:*",
     "@trigger.dev/rbac": "workspace:*",
     "@trigger.dev/redis-worker": "workspace:*",